CVE-2020-24052

Name of the Vulnerable Software and Affected Versions Moog EXO Series versions EXVF5C-2 and EXVP7C2-3

Description The issue concerns several XML External Entity (XXE) vulnerabilities. These vulnerabilities allow remote unauthenticated users to read arbitrary files by using a crafted Document Type Definition (DTD) in an XML request.

Recommendations For Moog EXO Series versions EXVF5C-2 and EXVP7C2-3, consider disabling the XML parsing functionality until a patch is available. Restrict access to the XML request handling module to minimize the risk of exploitation. Avoid using crafted DTDs in XML requests until the issue is resolved.